CVE-2026-114230: Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames

Q: Which deployments are exposed to this issue?

Apache Qpid Proton C deployments through version 0.40.0 are affected when they use SASL to authenticate peers. The practical impact depends on whether the application permits actions before authentication completion or accepts a peer with no user name.

Q: What does an attacker need to do to exploit the flaw?

An attacker needs to send regular AMQP frames that claim to be SASL frames during SASL frame dispatch. Proton may dispatch those frames, potentially bypassing authentication, while no user name is set.

Q: How can I determine whether the application may be at risk beyond using an affected version?

Review how the application handles connections for which authentication has not completed and no user name is present. Applications that authorize activity or otherwise proceed in that state may be vulnerable to meaningful impact.

Q: What should be done if an affected version is in use?

Upgrade Apache Qpid Proton C to version 0.41.1, which fixes the issue. Until then, ensure the application does not allow peer actions or authorization decisions before authentication is complete and a user name is available.

Published Oct 28, 2026

Updated

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.

This issue affects Apache Qpid Proton C: through 0.40.0.

Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Affected Software

1 affected component

Apache Qpid Proton C<=0.40.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Qpid Proton C to a version that resolves this vulnerability.
Fixed in 0.41.1

Event History

Oct 29, 2026

CVE Published

via MITRE·10:19 AM

Data Sourced

via MITRE·10:19 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache Qpid Proton C deployments through version 0.40.0 are affected when they use SASL to authenticate peers. The practical impact depends on whether the application permits actions before authentication completion or accepts a peer with no user name.

What does an attacker need to do to exploit the flaw?

An attacker needs to send regular AMQP frames that claim to be SASL frames during SASL frame dispatch. Proton may dispatch those frames, potentially bypassing authentication, while no user name is set.

How can I determine whether the application may be at risk beyond using an affected version?

Review how the application handles connections for which authentication has not completed and no user name is present. Applications that authorize activity or otherwise proceed in that state may be vulnerable to meaningful impact.

What should be done if an affected version is in use?

Upgrade Apache Qpid Proton C to version 0.41.1, which fixes the issue. Until then, ensure the application does not allow peer actions or authorization decisions before authentication is complete and a user name is available.

CVE-2026-114230: Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit the flaw?

How can I determine whether the application may be at risk beyond using an affected version?

What should be done if an affected version is in use?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit the flaw?

How can I determine whether the application may be at risk beyond using an affected version?

What should be done if an affected version is in use?